Privacy Policy

Ashand Care and Services Pty Ltd (ABN 90 674 454 856) provides aged care services under the Support at Home program, supports to participants of the National Disability Insurance Scheme (NDIS), and privately funded services. In this policy, we, us and our mean Ashand Care and Services Pty Ltd.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Because we provide a health service, the exemption that would otherwise apply to a small business does not apply to us — we are covered regardless of our size or turnover.

We deliver services across Australia. Where you are in New South Wales, Victoria or the Australian Capital Territory, additional state and territory health privacy laws apply to your health information alongside the Commonwealth Act, and we handle your information so as to meet them.

This policy explains what we collect, why we collect it, who we share it with, how we protect it, and what you can do if you are unhappy with how we have handled it.

Clients, participants, and the people we support

• name, date of birth, address, telephone number and email address;
• the name and contact details of your next of kin, emergency contacts, family, carers, nominee, guardian or authorised representative, and details of any decision-making arrangement that applies to you;
• health information — your diagnoses, medical history, medications, allergies, clinical risks, mobility and cognition, mental health, care and support needs, and notes made by our workers about the care we deliver;
• your NDIS participant number, plan, goals and budget; your My Aged Care reference number, assessment outcome and classification level; and your quarterly Support at Home budget and contribution details held with Services Australia;
• Medicare, Department of Veterans' Affairs, pension or concession card details where these are relevant to your funding;
• financial information needed to invoice you or to claim and acquit funding, including any co-contribution you are asked to pay;
• information about your cultural background, language, interpreter needs, religion, sexuality or gender identity, and whether you identify as Aboriginal or Torres Strait Islander — where you choose to tell us, so that we can deliver care that suits you;
• records of incidents, complaints, feedback and any restrictive practice that applies to you;
• details of your home and living situation relevant to delivering services safely, including access arrangements and any risks to workers.

Referrers

Where a hospital, general practitioner, support coordinator or other provider refers someone to us, we collect the referrer's name, role, organisation and contact details along with the referral itself.

Workers and applicants

We collect information from people who work for us or apply to: contact and identity details, work history, qualifications and training, referee comments, bank and superannuation details, tax file number, visa or work rights, immunisation status, and the results of an NDIS Worker Screening Check, police check or other screening the law requires for the role.

Visitors to our website

We use Vercel Web Analytics to count visits to the public pages of our website, so that we can see which pages people find useful. It does not use cookies, and it cannot follow you to other websites. Each page view records the address of the page, the site or search you arrived from, the date and time, your device type, browser and operating system, and an approximate location — country, region and city — worked out from your connection.

Visitors are counted using a code worked out from the connection itself rather than from anything stored on your device, and that code is reset every day, so the same person cannot be recognised from one day to the next. We do not use this visit counting for advertising or marketing, we do not sell it, and it is not joined to your care records.

This counting runs only on the public pages of our website. It is not used in the staff portal our workers sign in to, so no page about a person we support is ever recorded by it.

Apart from the measurement described below, our website loads no badges, fonts or scripts from other companies — the typefaces are served from our own site. Where you complete a form on our website, we collect what you enter into it.

When you send us a message through our website, we also keep a record that an enquiry was sent, the page it was sent from, and any campaign tags that were in the web address you arrived by — so that we can tell how people are finding us. That record holds no name, address, phone number or message, it is not joined to your enquiry or to your care records, and it cannot be used to work out who sent anything.

Google Analytics and our advertising

We advertise our services through Google, and we use Google Analytics on the public pages of our website to understand how many people who see an advertisement go on to contact us. This sets cookies on your device and sends Google the address of the page you are reading, roughly where you are connecting from, and your device and browser type. When you send us a message, it is also told that an enquiry was sent and which of our forms you used.

What you wrote is never sent to Google — not your name, your contact details, or anything you typed into the form. Those go to our own mailbox, and the count of enquiries we keep for ourselves is described above.

We have turned off the settings that would let this information be used to build a profile of you across other websites, or to target advertising at you afterwards. We use it only to count how well our advertising is working.

Google is based overseas and this information is held by them outside Australia. It is kept entirely separate from your care records, which are not sent to Google and are held in Australia — see section 9.

This runs only on the public pages of our website. It is not used in the staff portal our workers sign in to, so no page about a person we support is ever recorded by it. If you would rather not be counted, most browsers offer a setting to block this kind of measurement, and our website works the same either way.

Our hosting provider keeps ordinary server logs, which include the IP address your browser connects from, so that the site can be operated and kept secure. Signing in to our staff portal sets a cookie that keeps you signed in; that cookie is necessary for the portal to work and is not used to track you.

Health information is sensitive information under the Privacy Act and receives stronger protection than ordinary personal information. We collect it with your consent, or where the law otherwise allows us to — for example, where it is necessary to lessen or prevent a serious threat to someone's life, health or safety and consent cannot reasonably be obtained.

Information about your cultural background, religion, sexuality or gender identity is also sensitive information. You do not have to give it to us. We ask because it helps us deliver care that respects who you are, and we will deliver services to you whether or not you answer.

We collect information:

• directly from you, in conversation, by phone, or on our forms;
• from your family, carer, nominee, guardian or authorised representative;
• from the hospital, general practitioner, allied health professional, support coordinator or other provider who refers you or works with you;
• from My Aged Care, an aged care assessor, the National Disability Insurance Agency, or Services Australia, in connection with your eligibility and funding;
• from our own workers, as records of the care we deliver.

Where we collect information about you from someone else, the law requires us to take reasonable steps to make you aware that we hold it and why. Usually we do this when we first contact you about starting services.

• to assess whether we can safely and appropriately meet your needs;
• to plan, deliver, review and improve your care and supports;
• to coordinate with the other people involved in your care, so that your services work together rather than against each other;
• to contact you, and to contact your representative or next of kin, including in an emergency;
• to claim, acquit and report on funding, and to invoice you for any amount you are asked to contribute;
• to meet our obligations as an approved provider — including under the Aged Care Act 2024 and the Aged Care Quality Standards, and under the National Disability Insurance Scheme Act 2013, the NDIS Practice Standards and the NDIS Code of Conduct;
• to manage incidents, feedback and complaints, and to investigate them properly;
• to train and supervise our workers, and to maintain the quality and safety of our services;
• to obtain insurance and professional advice, and to establish or defend a legal claim.

We do not sell personal information, and we do not use it for marketing without your consent.

• your nominee, guardian, authorised representative, or the family and carers you have told us we can speak with;
• the health practitioners, allied health professionals, support coordinators, plan managers and other providers involved in your care;
• our workers and the contractors we engage to deliver your services, who are bound to keep your information confidential;
• the Department of Health, Disability and Ageing; Services Australia; My Aged Care; and the Aged Care Quality and Safety Commission;
• the National Disability Insurance Agency and the NDIS Quality and Safeguards Commission;
• our software and IT service providers, who host our records and systems under contract and may not use your information for their own purposes;
• our insurers, auditors and professional advisers;
• emergency services, where there is an immediate risk to someone's safety.

Sometimes we must share information whether or not you agree. This includes:

• reporting a serious incident under the Serious Incident Response Scheme in aged care, or a reportable incident to the NDIS Quality and Safeguards Commission;
• meeting mandatory reporting obligations concerning the abuse, neglect or exploitation of a child or an adult at risk;
• responding to a subpoena, warrant, court order or a lawful request from a regulator or law enforcement;
• acting to lessen or prevent a serious threat to any person's life, health or safety.

Where we can tell you that we have made such a disclosure, we will, unless doing so would be unlawful or would put someone at risk.

We hold information in electronic systems and, where relevant, in paper records. We protect it with access controls so that workers see only what their role requires, with confidentiality obligations in our employment and contractor agreements, with training, and with the physical security of our premises.

If we become aware of a data breach that is likely to result in serious harm, we will assess it and, where the Notifiable Data Breaches scheme requires, notify you and the Office of the Australian Information Commissioner.

We hold your care records in Australia, and we are not likely to disclose them to recipients outside Australia. If that changes we will update this policy and tell the people it affects.

Visiting our website is a separate matter. As described in section 2, our hosting provider records the IP address your browser connects from; the visit counts described in that section are handled by Vercel Inc., a company based in the United States; and the advertising measurement described there is handled by Google, which also holds it outside Australia. All three concern browsing our public website. None of them applies to the care records we hold about you, which stay in Australia.

You can ask us for a copy of the information we hold about you, and you can ask us to correct it if it is wrong, out of date, incomplete or misleading. Contact us using the details in section 13.

We will ask you to verify your identity, and we will respond within a reasonable period. There is no fee for making a request, though we may charge a reasonable amount for the cost of providing copies.

Occasionally the law allows us to refuse. This might happen where giving access would have an unreasonable impact on someone else's privacy, or would pose a serious threat to a person's life, health or safety. If we refuse, we will tell you why in writing and explain how to complain. If we decline to correct a record, you can ask us to attach a statement to it noting that you consider it inaccurate.

If you are unhappy with how we have handled your personal information, please tell us first — we would rather hear from you and put it right. Contact us using the details in section 13. We will acknowledge your complaint as soon as practicable, and in every case will acknowledge and respond to it within 30 days.

If you are not satisfied with our response, you can take it further:

Anywhere in Australia

• Office of the Australian Information Commissioner — oaic.gov.au, 1300 363 992
• Aged Care Quality and Safety Commission (for aged care services) — 1800 951 822
• NDIS Quality and Safeguards Commission (for NDIS supports) — 1800 035 544

Depending on where you live

• New South Wales — Information and Privacy Commission NSW, or the Health Care Complaints Commission
• Victoria — the Health Complaints Commissioner
• Australian Capital Territory — the ACT Human Rights Commission

You can also contact the National Aged Care Advocacy Line on 1800 700 600, or the National Disability Advocacy Finder, for free and independent help making a complaint.

We keep your information for as long as we need it to provide your services, and after that for as long as the law requires us to keep it. How long that is depends on the kind of record: clinical and care records, aged care and NDIS records, employment records and financial records are each subject to their own minimum retention periods, and some of them run for many years after our services to you end.

When we no longer need information and are no longer required to keep it, we destroy it or de-identify it securely.

For any question about this policy, to ask for access or correction, or to make a privacy complaint, contact our Privacy Officer using the details below.

We review this policy from time to time and may update it. The current version is always available at ashandcare.com.au/privacy-policy, and the date it was last updated appears at the top of this page. Where a change is significant, we will take reasonable steps to tell the people it affects.